Data Protection

We treat data protection as a core feature, not an afterthought. Every architectural decision is reviewed through the lens of customer privacy and security.

• Call recordings and transcripts
• Customer information collected by your AI receptionist
• Chat logs from your website widget
• Booking and appointment data

Cally Desk acts as the data processor and you, the customer, act as the data controller. A signed DPA is available on request to dpo@callydesk.com.

Production data is stored on servers located in North America. Data residency in the EU is available on Pro plans on request.

Default retention for call recordings is 90 days. Account and business data is retained for the life of your account. You may request deletion at any time by emailing dpo@callydesk.com.

For EU data subjects we rely on legitimate interest and contractual necessity as our lawful bases for processing. Data subjects have rights of access, rectification, erasure, restriction, portability, and objection.

California consumers have the right to know what personal information is collected, the right to delete, and the right to opt out of the sale of personal information. We do not sell personal information.

We employ encryption at rest (AES-256) and in transit (TLS 1.2+), strict role-based access controls, full access logging, and regular third-party penetration testing.

In the unlikely event of a data breach affecting your data, we commit to notifying you within 72 hours of discovery.

• Twilio — calls and SMS
• Stripe — payments
• Google — calendar integrations
• Supabase — database
• Vercel — hosting

Email our Data Protection Officer at dpo@callydesk.com.